GDPR & data protection

Overview

Tonic Research is designed for universities and research institutions in the UK and EU. This statement supplements our Privacy Policy with GDPR-specific information.

Most research document content is processed on behalf of your institution (controller). LaunchPad Labs (processor) processes that content only under documented instructions.

Controller and processor roles

• Institution (controller): determines purposes of processing uploaded papers, retention policies, and lawful basis for research data.
• LaunchPad Labs (processor): provides Tonic Research translation infrastructure, storage, and access controls under a Data Processing Agreement (DPA).
• LaunchPad Labs (controller): account metadata, service logs, and billing-related data needed to operate the platform.

Lawful bases

Institutions typically rely on public task, legitimate interests, or contract for enabling staff and students to translate research materials. You should confirm the basis applicable to your organisation.

For processor activities, we process personal data only on documented instructions from the controller.

Research and special-category data

Uploaded papers may contain personal data incidental to research (e.g. author names, acknowledgements). Institutions must ensure an appropriate lawful basis and any required safeguards before upload.

Do not upload patient-identifiable health data or other special-category data unless your institution has explicitly authorised this use case and appropriate controls are in place.

Data Processing Agreement

Institutional customers receive a DPA with LaunchPad Labs covering subject matter, duration, nature and purpose of processing, types of personal data, obligations, sub-processors, security measures, breach notification, and deletion on termination.

To request a DPA or sub-processor list, contact hello@launchpadlabs.uk.

International transfers

Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as UK International Data Transfer Agreements, EU Standard Contractual Clauses, or adequacy decisions, as applicable to each sub-processor.

Primary application hosting is on Vercel, typically an EU region, unless otherwise agreed in contract.

Sub-processors

Current categories of sub-processors include:

• Cloud hosting (Vercel)
• Database, authentication, and storage (Supabase)
• Identity provider (Microsoft Azure AD / Entra ID)
• Microsoft Graph / OneDrive (optional import of manuscripts you select)
• Translation compute infrastructure (contracted, access-controlled)

Retention and deletion

Retention periods are set per institutional contract. On expiry or written request from the controller, we delete or return personal data unless law requires retention.

A user may also delete their own account from Account in the product. That permanently removes their papers, translations, files, and account, and is not recoverable.

Backups are rotated on a defined schedule and purged in line with the DPA.

Personal data breaches

We notify the controller without undue delay after becoming aware of a personal data breach affecting their data, with information required under Article 33 GDPR to support their regulatory obligations.

Data subject rights

Individuals should direct access, erasure, and other rights requests to their institution as controller. LaunchPad Labs assists controllers in responding within agreed timeframes.

Users can erase their own account and associated documents from Account in the product. That deletion is permanent and not recoverable.

You may contact hello@launchpadlabs.uk for assistance routing a request.

DPIA support

Institutions may need a Data Protection Impact Assessment for research translation tools. We can provide architecture summaries, security controls documentation, and sub-processor details to support your DPIA.

Data controller details

Where LaunchPad Labs acts as controller for platform operations data, the controller is LaunchPad Labs (Company No. 17137093), registered in England and Wales.